CVE-2026-32264

Published: Mar 16, 2026Modified: Mar 17, 2026

8.6

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.

Affected (8)

Products: Craftcms: Craft Cms

Craftcms

1 product

Craft Cms

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Craftcms Craft Cms	From 4.0.0.1 to 4.17.5
Craftcms Craft Cms	From 5.0.1 to 5.9.11
Craftcms Craft Cms	Version 4.0.0
Craftcms Craft Cms	Version 4.0.0 rc1
Craftcms Craft Cms	Version 4.0.0 rc2
Craftcms Craft Cms	Version 4.0.0 rc3
Craftcms Craft Cms	Version 5.0.0
Craftcms Craft Cms	Version 5.0.0 rc1